Module wire 

RADIUS client packets: what the server’s packet.rs leaves out because a server never needs it — building requests, and checking a reply’s two authenticators against the request.

The header, attribute TLVs, User-Password hiding (RFC 2865 §5.2), the Response Authenticator (§3) and the Accounting-Request Authenticator (RFC 2866 §3) are src/server/radius/packet.rs, shared. This module adds the three constructions only a client makes: CHAP-Password (RFC 2865 §2.2), the Message-Authenticator HMAC-MD5 (RFC 3579 §3.2) on both requests and replies, and the order they must be computed in.

Pure functions; no I/O, no state. The shared secret is a parameter and is returned in nothing.

Re-exports

pub use crate::server::radius::packet::hmac_md5;

Structs

BuildError

Why a packet could not be built.

Enums

Credential

How an Access-Request carries its password.

ReplyError

Why a reply was refused.

Functions

access_request

An Access-Request (RFC 2865 §4.1), always carrying a Message-Authenticator.

accounting_request

An Accounting-Request (RFC 2866 §4.1). Its authenticator is a keyed digest of the whole packet, so it is computed here, and returned so replies can be checked against it.

chap_password

CHAP-Password’s value: the CHAP identifier, then MD5(id | password | challenge).

status_server

A Status-Server (RFC 5997 §3), which must carry a Message-Authenticator.

verify_reply

Decode a reply and check it against the request it answers, in the order that matters: the code, then the Response Authenticator (RFC 2865 §3), then the Message-Authenticator (RFC 3579 §3.2, computed over the reply with the Request Authenticator in the authenticator field). Nothing in an unverified reply reaches the model.